CVE-2025-50234 describes a Server-Side Request Forgery (SSRF) vulnerability in MCCMS v2.7.0, specifically within the Gf.php file's index() method, affecting the 'pic' parameter. An attacker can exploit a hard-coded encryption key to decrypt a malicious 'pic' parameter, forcing the system to make requests to internal addresses or local file paths. This allows for reading sensitive files (e.g., /etc/passwd) and potentially accessing internal services, leading to information leakage or system compromise. The vulnerability is rated Medium (CVSS 6.5), indicating it can be exploited remotely without authentication and with low attack complexity, primarily impacting confidentiality and integrity. Its FAUCET Risk Score is 62/100. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, which is typical for the vast majority of reported vulnerabilities.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
2.7CPE matchmatch criteria | cpe:2.3:a:chshcms:mccms:2.7:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.